What is claimed is: 

1. An anonymous fingerprinting method using a bilinear 
Dif f ie-Hellman problem, in a fingerprints embedment system 
5 that includes three participants, comprising the steps of: 

(a) introducing system parameters shared by a first 
and a second participant, storing the system parameters in a 
memory of each of the first and the second participant and 
generating a public key and a secret key of the first 

10 participant; 

(b) registering information on the first participant 
to a third participant based on the system parameters and 
the public and the secret key of the first participant, 
wherein the third participant issues a certificate based on 

15 the information on the first participant; 

(c) at the second participant, authenticating a 
fairness of the first participant based on the certificate; 

(d) embedding fingerprints into a digital content to 
be bought by the first participant; and 

20 (e) when an illegal duplicate of the digital content 

or an illegally redistributed duplicate is found, 
identifying a traitor, who illegally duplicates the digital 
content or redistributes the illegally duplicated digital 
content, with the first participant based on the 

25 fingerprints embedded in the digital content. 
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2. The method of claim 1, wherein the step (a) includes 
the steps of: 

(al) generating Gi and G2, wherein Gi is an elliptic 
curve group and G2 is a cyclic multiplicative group; 
5 (a2) taking a generator P out of the cyclic 

multiplicative group G 2 ; 

(a3) calculating a bilinear map e on the groups GI and 
G2 as follows: 

e: G± x d —> G 2 

10 (a4) storing the system parameters in a storage medium 

of the third participant and opening the system parameters 
so that the first and the second participant can use them, 
wherein the system parameters has Gi, G2 and P; 

(a5) selecting a secret key of the first participant 
15 out of G2/ wherein the secret key of the first participant 
is formed of Si, s 2 and S3; and 

(a6) calculating a public key y B of the first 
participant as follows: 

y B = e(P, P) 515253 . 

20 

3. The method of claim 2, wherein the step (b) includes 
the steps of: 

(bl) generating a random value x R corresponding to G2 ; 
(b2) calculating a confidential value T R as follows: 
25 T R - x R P 

and sending the confidential value T R to the first 
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participant; 

(b3) calculating pseudonym keys X and Y of the first 
participant as follows: 
X = SiS 2 P 
5 Y = s 1 s 2 s 3 P + T R ; 

(b4) verifying validity of X and Y as follows: 

e(Y, P) = y s • e(P, T R ) ; 
(b5) calculating T as follows: 

r = efx, r*; 

10 and storing T in a memory of the third participant, wherein 
T is an intermediate value for judging whether or not the 
first participant is an owner of a secret key corresponding 
to the pseudonym keys X and Y; 

(b6) issuing the certificate, which proves a fairness 
15 of the first participant to the second participant, and 
delivering the certificate to the first participant; and 

(b7) at the first participant, calculating T' as 
follows : 

T' = e(X, T R ) 

20 * and viewing^ (Y, T' ) as a pseudonym pair to safely store the 
pseudonym pair in a memory of the first participant, wherein 
T" is a value for notifying that the first participant is an 
owner of the secret key corresponding to X and Y. 

25 4. The method of claim 3, wherein the step (c) includes 
the steps of: 
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(cl) sending the pseudonym pair and text to the second 
participant, wherein the text represents normal information 
about a digital content to be fingerprinted; 

(c2) selecting a random value k out of G 2 to generate a 
5 B-DH signature Sig for the text, as follows: 

Sig = sign (text, s lf s 2/ s 3 , Xr, k) ; and 
(c3) verifying validity of the certificate and storing 
T' and the certificate as a purchase record of the first 
participant in a memory of the second participant. 

10 

5. The method of claim 4, wherein the step (d) includes 
the steps of : 

(dl) at the first participant, sending x R , Sig, Si, s 2 
and the certificate to the second participant and, at the 
15 second participant, presenting T" , Y, em and the text to the 
first participant, wherein em denotes the digital content to 
be fingerprinted; 

(d2) generating a specific value vali as follows: 
valj = Verify! (text, sig, Y) 
20 wherein vali is a Boolean variable to be seen by the second 
participant when verification of Sig is completed; 

(d3) generating a particular value val 2 as follows: 
val 2 = Verify 2 (Y, Cert (Y\ x R ) , s lf s 2 , x R , T) 
wherein val 2 is a Boolean variable to be seen by the second 
25 participant when the certificate and Sig are respectively 
verified; 
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(d4) generating emb as follows: 

emb = text \ Sig | Y | Cert(Y\x R ) | s 2 t s 2 I x R \ T' 
and storing emb in a memory of the second participant, wherein 
emb represents fingerprints to be embedded into the digital 
5 content em; and 

(d5) obtaining a fingerprinted digital content em* as 
follows : 

em* = Fing(em, emb). 



10 6. The method of claim 5, wherein the step (e) includes 
the steps of: 

(el) verifying validity of Sig for the text as 
follows : 

T" = e(s 2 s 2 P, x R P) 
15 wherein T" is a value for checking whether the first 
participant is an owner of a secret key corresponding to the 
pseudonym key Y' ; and 

(e2) determining an owner of the pseudonym key Y' to 
be the traitor if the pseudonym key Y' is given as follows: 
20 . e(Y' , P) - y B • e (P, P) x R . 

7. An anonymous fingerprinting apparatus using a bilinear 
Dif f ie-Hellman problem, comprising : 

a registration authority; 
25 a buyer; and 

a merchant, 
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wherein the apparatus' performs the steps of: 

introducing system parameters shared by a first and a 
second participant, storing the system parameters in a 
memory of each of the first and the second participant and 
5 generating a public key and a secret key of each of the 
first and the second participant; 

registering information on the first participant to a 
third participant based on the system parameters and the 
public and the secret key of the first participant, wherein 
10 the third participant issues a certificate based on the 
information of the first participant; 

at the second participant, authenticating a fairness 
of the first participant based on the certificate; 

embedding fingerprints into a digital content to be 
15 bought by the first participant; and 

when an illegal duplicate of the digital content or an 
illegally redistributed duplicate is found, identifying a 
traitor, who illegally duplicates the digital content or 
redistributes the illegally duplicated digital content, with 
20 the first participant. 
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